snlavaise/pmaports-rtwo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kconfigcheck: switch to LOCK_DOWN_KERNEL_FORCE_INTEGRITY

Browse Source 
The current systemd user namespaces model
almost works with confidentiality, but a single
check for kprobes is used, which confidentiality
disables, so user namespaces fail. For now,
just downgrade lockdown to integrity until this
is sorted out in systemd.

Signed-off-by: Aster Boese <asterboese@mailbox.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8988>
This commit is contained in:
Aster Boese
2026-07-10 13:45:28 +00:00
committed by The Friendly Meow (merge) Bot
parent 6020880b4a
commit 3b5032d29c
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kconfigcheck.toml
+2 -2
View File
@@ -714,11 +714,11 @@ SECURITY_SELINUX_BOOTPARAM = "y"
# Enforce kernel lockdown, separate from hardening to keep it opt-in for now
["category:lockdown".">=0.0.0"."all"]
# NOTE: Enforcing confidentiality like this removes the ability to disable
# NOTE: Enforcing integrity like this removes the ability to disable
# lockdown on the cmdline. This makes it harder for attackers to disable
# lockdown, but also makes it harder for users as well, since only a
# rebuild of the kernel can disable it.
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY = "y"
LOCK_DOWN_KERNEL_FORCE_INTEGRITY = "y"
# Wine / Proton support
["category:wine".">=6.14.0"."all"]